Registry write to a known UAC bypass hijack key

1title: Registry write to a known UAC bypass hijack key2id: 35087c6f-73b0-4d35-ba7d-45eb9563e7463status: experimental4description: |5  Matches registry writes to the per-user keys an auto-elevating binary reads6  when it is hijacked: the shell-open command classes used by the fodhelper,7  eventvwr, sdclt and computerdefaults family (ms-settings, mscfile, exefile8  runas, Folder and the AppX class the store handler uses), plus the Environment9  windir value that the SilentCleanup scheduled task expands. AN0975's other10  half — "unusual parent-child process relationships" — has no concrete value11  list at parent-technique level and would be arbitrary, so the rule is built on12  the registry evidence, which is bounded and specific.13  Two things a reader has to be told. First, every key here is T1548.002 Bypass14  User Account Control; the rule is filed under the parent because that is the15  brief it was authored from, but nothing it matches touches .001 setuid, .00316  sudo, .004 elevated prompts, .005 cloud access or .006 TCC, and the tags name17  .002 for that reason. Second, the class list is illustrative rather than18  closed — new auto-elevating binaries and their handler classes are found19  regularly, and a COM elevation-moniker bypass such as ICMLuaUtil writes no20  registry value at all.21  The three UAC policy values (EnableLUA, ConsentPromptBehaviorAdmin,22  LocalAccountTokenFilterPolicy) are deliberately not in the selection. They are23  applied as Security Settings, which the policy client re-applies on its own24  refresh interval — 16 hours by default — on every managed host whether or not25  anything changed, so a UAC baseline GPO produces them per host per cycle26  forever. ORing that volume into these near-zero-noise keys would make the27  whole rule unshippable at this level; they belong in a separate low-severity28  hunt. The correlation MITRE describes, a write followed by an elevated spawn29  inside a time window, is not expressible in Sigma either way.30  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0345, not hand-written and not tested by its author. Any lab result is on this rule's own page.31references:32  - https://attack.mitre.org/techniques/T154833  - https://attack.mitre.org/detectionstrategies/DET034534author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)35date: 2026-08-1636tags:37  - attack.privilege-escalation38  - attack.t154839  - attack.t1548.00240logsource:41  category: registry_set42  product: windows43detection:44  selection:45    TargetObject|contains:46      - '\Software\Classes\ms-settings\shell\open\command'47      - '\Software\Classes\mscfile\shell\open\command'48      - '\Software\Classes\Folder\shell\open\command'49      - '\Software\Classes\exefile\shell\runas\command\isolatedCommand'50      - '\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command'51      - '\Environment\windir'52  condition: selection53falsepositives:54  - "Machine-side class registration during operating-system setup, servicing and feature updates. The rule matches on the class path only and does not pin the hive, so the HKLM\\SOFTWARE\\Classes copies of ms-settings, mscfile and Folder shell-open commands match exactly as the HKCU ones do."55  - "Setup and sysprep writing the machine environment block at HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment, which contains a windir value and so matches the last entry on every image build and on some servicing reboots."56  - "Shell tweaks and file-association repair tools — alternative file managers, 'open command window here' utilities and portable applications — which rewrite Folder\\shell\\open\\command or the exefile runas verb for the current user."57  - "Control validation and purple-team tooling (Atomic Red Team and similar harnesses) that creates and deletes these exact keys on a schedule to test endpoint coverage."58level: high